GoConqr hat ein neues Design! Sag uns, wie es dir gefällt.

Kostenlos registrieren

Karteikarten

IS test 3

ashleo92 Englisch 77 Karten

Karten in diesem Stapel (77)

  1. 1risk assessmentdetermines level of risk to the firm if specific activity or process is not properly controlled
  2. 2security policyranks information risks, identifies acceptable security goals, and identifies mechanisms for achieving these goals
  3. 3acceptable use policy (AUP)defines acceptable uses of firm's information resources and computing equipment
  4. 4authorization policiesdetermine differing levels of user access to information assets
  5. 5disaster recovery planningdevises plans for restoration of disrupted services
  6. 6backupcopies of critical systems and data, done on a regular basis
  7. 7hot siteseparate and fully equipped facility where the firm can move immediately after a disaster and resume business
  8. 8cold siteseparate facility without any computer equipment but is a place employees can move after a disaster
  9. 9business continuity planningfocuses on restoring business operations after disaster
  10. 10MIS auditexamines firm's overall security environment as well as controls governing individual information systems
  11. 11identity management systemssupport the organization's security and authorization policies
    -include business processes and technologies for identifying valid users of systems
  12. 12authenticationthe ability to know that a person is who he or she claims to be; a method of confirming users' identities.
  13. 13authorizationdetermines what actions, rights, or privileges the user has, based on the verified identity
  14. 14common types of access controlsuser IDs, cognitive passwords, security profile, token/security token, smart card, biometrics, terminal resource security
  15. 15passwordcombination of numbers, characters, and symbols that's entered to allow access to a system
  16. 16passphraseseries of characters that is longer than a password but is still easy to memorize
  17. 17cognitive passwordrequires a user to answer a question to verify their identity; commonly used as a form of secondary access
  18. 18security profilea unique picture and descriptive phrase chosen by you to verify that you are on a legitimate site
  19. 19tokena small device to change user passwords automatically
  20. 20smart carda device about the same size as a credit card, containing a chip formatted with access permission and other data-a reader device interprets the data on the card and allows or denies access
  21. 21terminal resource securitysoftware feature that erases the screen and signs of user off automatically after a specified length of activity
  22. 22biometricssystems that read and interpret individual human traits to enhance security measures – are unique to a person and can’t be stolen or lost; may be physical or behavioral
  23. 23firewall-Combination of hardware and software that controls the flow of incoming and outgoing network traffic
    -Combination of hardware and software that controls the flow of incoming and outgoing network traffic
  24. 24intrusion detection systems-Monitor hot spots on corporate networks to detect and deter intruders.
    -Examine events as they are happening to discover attacks in progress
  25. 25antivirus and antispyware softwareCheck computers for presence of malware and can often eliminate it as well.
  26. 26(UTM) unified threat management systemsCombination of security tools including firewalls, intrusion detection systems, VPN’s, web content filtering, and anti-spam SW
  27. 27encryptionProcess of encoding messages before they enter the network & then decoding at the receiving end
  28. 28two methods of encryption1.symmetric key encryption
    2.public key encryption
  29. 29symmetric key encryptionsender and receiver use single,shared key
  30. 30public key encryption-uses two, mathematically related keys: public key and private key
    -sender encrypts message with recipients' public key
    -recipient decrypts with private key
  31. 31two methods/protocols for encryption on networks1. secure sockets layer (SSL)
    2. Transport layer security (TLS)
  32. 32TLSenable client and server computers to manage encryption and decryption activities as they communicate with each other during a secure web session; establish a secure connection between two computers
  33. 33S-HTTP (secure hypertext transfer protocol)is limited to individual messages
  34. 34digital certificate-Data file or electronic document used to establish the identity of users and electronic assets for protection of online transactions
    -Uses a trusted third party, Certificate Authority (CA), to validate a user’s identity
  35. 35fault tolerant computer systemsContain redundant hardware, software, and power supply components that create an environment that provides continuous, uninterrupted service
  36. 36high-availability computing-Helps recover quickly from crash
    -Minimizes, does not eliminate, downtime
  37. 37DPI (deep packet inspection)Sorts out low-priority online material (music and video downloads) while assigning a higher priority to business-critical files and data
  38. 38cloud computingAccountability and responsibility for privacy and security reside with the Cloud user, although the Cloud provider is actually doing the hosting ...
  39. 39mobile computing devicemust be secured like other in-house, non-mobile resources against malware, theft, accidental loss, unauthorized access, and hacking attempts
  40. 40software metricsobjective assessments of a system in the form of quantified measurements, such as: number of transactions processed per min, online response time, etc.
  41. 41walkthroughreview of specification or design documents by a group of qualified people
  42. 42debuggingprocess by which errors are discovered and eliminated
  43. 43WEPinitial security standard for 802.11- use is optional- users often fail to use its security features.
  44. 44MalwareSW written with malicious intent to cause annoyance or damage to a computer system or network
  45. 45virusesrogue software program that attaches itself to other software programs or data files in order to be executed
  46. 46worms-independent programs that copy themselves from one computer to others over a network
    -do not have to be attached to a host program
  47. 47Trojan horse-software program that appears to be benign but then does something other than expected
    -contains code intended to disrupt a computer network, or website
    -malicious code hides inside a popular program or a program that appears useful
  48. 48SQL injection attackstake advantage of vulnerabilities in poorly coded web application SW to introduce malicious program code into a company's systems and networks
  49. 49spywaresw that secretly gathers information about users while they browse the web; can come hidden in free downloads and tracks online movements, mines the info stored on a computer, or uses the computer's
  50. 50keyloggersmonitor and record keystrokes and mouse clicks
  51. 51spoofing-misrepresenting oneself by using fake e-mail addresses or masquerading as someone else
    -may involve forging return address of email so it appears to be from someone else.
  52. 52sniffer-type of eavesdropping program that monitors information traveling over a network
    -SW used to capture and record network traffic
  53. 53DoS (denial of service attacks)floods a network server or web server with thousands of false service requests to crash the network
  54. 54DDoS (distributed denial of service attack)hundreds of thousands of computers work together to bombard a website with thousands of requests for information in a short period
  55. 55botnetsnetworks of "zombie" PC's infiltrated by bot malware
  56. 56phishinga high tech scam in which an email requests the update or confirmation of sensitive personal information by masquerading as a legitimate request/website
  57. 57pharminga type of phishing technique that redirects users to a bogus web page, even when an individual types correct web page address into his or her browser
  58. 58evil twinsa type of phishing technique where wireless networks that pretend to offer trustworthy wi-fi connections to the internet
  59. 59insiderslegitimate users who purposely or accidentally misuse their access to info or resources and cause some kind of business-affecting event
  60. 60hackerspeople very knowledgeable about computers who use their skill to gain unauthorized access to a computer system
  61. 61patchessmall pieces of software to be released by a SW vendor to repair flaws
  62. 62gramm-leach-biley actrequires financial institutions to ensure the security and confidentiality of customer data
  63. 63sarbanes-oxley actimposes responsibility on companies and their management to safeguard the accuracy and integrity of financial information that is used internally and released externally
  64. 64computer forensicsscientific collection, examination, authentication, preservation, and analysis of data from computer storage media for use as evidence in court of law
  65. 65general controlsgovern, design, security, and use of computer programs and security of data files in general throughout organization's information technoogy infrastructure
  66. 66application controlsspecific controls unique to each computerized application, such as payroll or order processing
    include:-input controls
    -processing controls
    -output controls
  67. 67Securitypolicies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems
  68. 68Controlsmethods, policies, and organizational procedures that ensure safety of organization's assets; accuracy and reliability of its accounting records;and operational adherence to mgt standards
  69. 69Computer crime/fraud"any violations of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution"
  70. 70Identity Theft-a crime in which an imposter obtains key pieces of personal information to impersonate someone else
    -the forging of someone's identity for the purpose of fraud
  71. 71Click fraudoccurs when an individual or computer program fraudulently clicks on an online ad without any intention of learning more about the advertiser or making a purchase
  72. 72Why systems are vulnerable-hardware problems
    -software problems
    -disasters
    -user error or unauthorized access
    -use of networks and computers outside of firm's control
  73. 73hardware problemsbreakdowns, configuration errors, damage from improper use of crime, theft of devices
  74. 74Software problemsprogramming errors, installation errors, unauthorized chnages
  75. 75disasterspower failures, flood, fires, others...
  76. 76War drivingeavesdroppers drive by buildings and try to intercept network traffic
  77. 77Rogue access pointaccess point on a different channel in a close physical location to force a users radio network interface controller to associate with the rogue access point instead of the official one

Informationen

Beschreibung
Karteikarten am IS test 3, erstellt von ashleo92 am 11/04/2013.
Erstellt von
ashleo92 · Apr 2013
Aktualisiert
13 Mai 2016
Aufrufe
103
Bewertung

Feedback

Worum geht es?

Wie gefällt dir das neue Design?

Dein Eindruck